2

I am checking the security of my Django application through a security scanner and I wonder if it useful to set the X-Frame-Options DENY header on static assets like CSS, images or JS files?

I guess one may achieve to upload a HTML file disguised as something else (like an image) and still be served the same way, and then be able to execute JS on my domain (thus accessing some cookies). But it's not linked to being executed in an iframe so I can't see any attack vector this header would protect me from.

I already have the header set on the rest of my website (all the views handled by Django itself).

  • Are you planning on allowing people to upload things to your server? If not, how would it get there in the first place? – Robert Mennell Mar 9 '16 at 17:16
  • I have no idea and I try to get the more generic threat model (so let's say I allow users to upload files). Does adding the header have any impact on the security? – Mickaël Mar 9 '16 at 22:20
  • Only in that it will prevent that content from being loaded inside of a frame(as long as the browser is compliant with it, but it never became a standard). It shouldn't harm it. – Robert Mennell Mar 9 '16 at 23:12
1

So after the little conversation for clarity in the comments on the opening question and finding out a bit more(like that you aren't allowing uploads to your server), then the answer is a simple No, it should not harm it. In fact in the simple case that a malicious person does get code onto your server some way, this could help it, however in that case I think you have a much larger problem to worry about.

Really it comes down to more of a question of "Do I want someone else having access to my static assets inside of a frame?", in which case the answer is usually a no.

  • can I assume from your answer that X-Frame-Options : SAMEORIGIN or DENY response header should also be added to static resources if I don't want them to be seen in someones iframe? – Olena Horal Dec 27 '16 at 16:55
  • 1
    That is covered in its specifications. You can find more information easily. Basically this header tells browsers that support it "only load me in frames from these specific sites", so yes in the context of frames – Robert Mennell Dec 27 '16 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.